Hacker News Reader

Comment by politelemon | Hacker News Reader

This is a great news and an excellent addition to F-Droid. I hope this is a little nudge to Signal to reconsider inclusion. I believe they're mostly there, they already have an APK built as a reproducible build (https://signal.org/blog/reproducible-android/) with FOSS components (https://signal.org/android/apk/)

View on HN

Unfortunately Signal devs seem dead-set against F-Droid (whether on F-Droid, or hosting their own F-Droid repository) for some reason.

https://github.com/signalapp/Signal-Android/issues/9044#issu...

https://community.signalusers.org/t/signal-f-droid-repositor...

[EDIT] Last response of theirs on this issue I could find: https://community.signalusers.org/t/wiki-signal-android-app-...

>For the vast majority of people, installing apps from third-party app stores like F-Droid requires them to enable “unknown sources”. Signal’s developers feel that normalizing this kind of behavior would be “a reversion back to the desktop security model” and that endorsing it through participation would be harmful. The only reason they distribute an APK outside of the Play Store is to reduce the harm of non-technical people installing fake apps instead.

I guess it somewhat makes sense that they're against the desktop model of app distribution, but IMO the phone model is not worth the added security. Signal may not have any problems as a messaging app, but both google and apple have some ridiculous rules that categories of apps have to comply with. In particular if you're an app for any sort of art community, prepare to tell your users to censor even mildly suggestive artwork, violent content, content dealing with drug use (even if not glorified), etc. That's not to speak of countless other limitations.

The desktop mode of distribution ain't so bad. at least you're still in charge of your own device

I find it extremely suspicious, and have pointed it out to others before, that the Signal developers refuse to distribute it without Google Play services (spyware). Coupled with its CIA funding background, I'm glad I've used it. https://yasha.substack.com/p/signal-is-a-government-op

Not everything government-funded must be government-backdoored, that is quite the conspiracy theory for an open source application.

You can also download the APK directly from the website (not using Google's store), which will self-update, and will function also if you don't have Google Play Service on your device.

There are caveats, like if you firewalled off Google services because outright removal will mess up other apps and an alternative ROM with µG means no more (proper) camera app: in that case Signal will detect Google Play, wait indefinitely for the push message via Google, and thus not function at all. So I don't like to defend them on this front, but it's simply not true that it's impossible to use without a Google backdoor on your phone.

It’s because they use FCM for sending push notifications and you need Google Play Services to use FCM. And Signal uses push notifications to know when to wake up and fetch data. Otherwise, it has to poll and do other ugly stuff which drains your battery quicker or makes the user experience much worse.

Signal’s taking a pragmatic approach that’s the best for most people, but not everybody.

That’s not true. Signal does provide an Android version without Google Play Services.

https://signal.org/android/apk/

I’ve used it for a long time on a GrapheneOS phone with zero Google software installed at all.

> https://signal.org/android/apk/

Direct link for those without javascript:

https://updates.signal.org/android/Signal-Android-website-pr...

I think that Molly (https://molly.im/) is a good option if you want to manage "Signal" via F-Droid.

Signal has a reputation that Molly lacks. If Signal team doesn't want to post to F-Droid, it would help if they at least made a statement of support or opposition to Molly.

I doubt they would ever endorse the use of a third party interface to Signal.

In fact they have publicly whined about it already

Molly does not seem to be included in the official fdroid repo. You can also simply add the calyxos fdroid repo to get signal via fdroid

https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fing...

Yeah, that is why I said "manage via F-Droid". The implication is that F-Droid (the app) is responsible for updating your application, not some background service bundled in Signal itself.

Their webpage claims both:

> Molly, like Signal, uses Google’s proprietary code to support some features And

>Fully FOSS >Contains no proprietary blobs, unlike Signal.

It's also not clear if it can be used as a drop-in replacement to contact people using Signal

They have two versions!

Molly, like Signal, uses Google’s proprietary code to support some features.

Molly-FOSS is the community effort to make it 100% free and open-source.

That explains my confusion. Thank you

> if it can be used as a drop-in replacement

I had to click through to their github to find: "Molly connects to the Signal server, so you can chat with your Signal contacts seamlessly.

Molly and Signal apps can be installed on the same device. If you need a 2nd number to chat, you can use Molly along with Signal.

However, you cannot use the same phone number on both apps at the same time."

I use Aurora Store to anonymously download and update apps on Google Play store, all without any Google Play services (I run GrapheneOS). Signal app on my phone is basically the same APK on Play store.

Have you compared it to APKPure? Just wondering which "store"/repo is more trustworthy, because recently APKPure have shifted to apkx format, which is natively unusable without their own installer app.

Aurora gets apks directly from Play Store via reverse engineered api

What's the benefit to having Signal on F-Droid vs. downloading the APK?

Manage your version. Trust your APK source.

The same advantage as having 30 updaters run in the background versus running

    apt update

Imagine every app you install, from your calculator to your chat applications, has to have its own updater. That's why I like F-Droid rather than downloading the Signal APK directly. Already have to do this for Threema unfortunately, as they're neither on F-Droid nor freely available on the Play store.

To help clarify to GP (was going to help reply then saw yours) F-Droid is both the name of the core website hosting the APK repos and build infra, and the name of the Android client which can connect to any F-Droid compatible repo - there are a bunch of projects who host their APKs in their own F-Droid repo, all you have to do is go to their website and scan the QR code to add it or enter manually.

Signal could run their own F-Droid repo and people just add to their F-Droid client without using or touching the F-Droid website or build infrastructure at all, which would allow folks to do as lucgommans explains - one phone client connected to many repos, no manual downloading.

Example: https://www.bromite.org/fdroid

I hadn't even thought of this, that's a good point and (afaik) negates the entire excuse of Signal's not to be on F-Droid.

I think Signal's direct-download APK version (i.e., from signal.org, not from an app store) automatically prompts for updates (can someone verify?).

Correct. I use it on LineageOS

It does, but that's my point: it ships with its own updater rather than leaving me to just manage updates with a proper repository client (like apt, dnf, f-droid, google store, whatever).

Presence in the main F-Droid repository requires the app to be open-source. A downloaded APK might include closed-source components.

"The main repository, hosted by the project, contains only free and open source apps... The website also offers the source code of applications it hosts... F-Droid builds apps from publicly available and freely licensed source code. New apps, which must be free of proprietary software are contributed by user submissions or the developers themselves."

https://en.wikipedia.org/wiki/F-Droid

Reply on news.ycombinator.com